Setup ACL role to administer smart group

[flo81]

Hello,

I work on my first CiviCRM / Drupal (I'm new to Civi but quite experienced on Drupal) project and I'm having trouble to achieve a simple ACL configuration.

I have smart groups, based on relationships between contacts and organizations. I need to create a Drupal user who administers one of these groups (search, edit, create, delete).

So far I :

- created a Drupal role
- give to this role a few permissions (Drupal side) :
--- add contact
--- display my own contact
--- edit my own contact
--- access all custom data (I have custom datas on my contacts, everyone should be able to see them)
--- access CiviCRM
--- access contact dashboard
- create a new Drupal user, give him the new role
- create an ACL group in CiviCRM, add my new user to this group
- create an ACL role in CiviCRM, assign my ACL role to the new group
- create 2 ACL for my new role : edit and view all contacts in one particular smart group (say group A)

My new user can access the contact search page, and there is only the group A in the dropdown (so far so good), but no contacts are displayed when I search in this group. The quick search field (top left) doesn't work even when I type the first letters of the name of a contact which is in the group A.

What am I doing wrong here ? How to create an ACL "search contacts in group A" (it seems that it would solve my problem) ?

Thank you

[Dave Greenberg]

Seems like your setup is correct. Maybe try a few "experiments" to see where things are breaking down:

* if the smart groups are recently created, make sure this isn't an issue with smart group cache not being updated (you can rebuild cache's by accessing /civicrm/menu/rebuild?reset=1)

* remove the 'display my own contact' and 'edit my own contact' permissions from the Drupal role (possibly these are interacting incorrectly with the ACL permissioning - bug ??)

* create a regular group with some of the target contacts (rather than a smart group) and use that in your 2 ACLs

[flo81]

Thank you, I try and report back here.

[flo81]

OK, it works fine with a static group. Something I didn't mention and wihch is certainly the cause of my problem : my smart group has a parent group (which also have a parent group). I will try to create ACL for my user on the "ancestors groups" too, and see if I can get what I want this way.

[flo81]

It seems that I ran into this :

https://issues.civicrm.org/jira/browse/CRM-10135

EDIT

Issue seems to be solved in 4.5.5 : https://issues.civicrm.org/jira/browse/CRM-15662, so I try to upgrade CiviCRM (from 4.5.4)

[flo81]

OK, I upgraded to 4.5.8, all went fine, but I have a different problem now. I have my user in an ACL group, I set up 2 ACLs for this group : view and edit contacts in a particular smart group. With this, when I try to perform a contact search, I still have only the smart group in the drop down, but I get a database error :

nativecode=1066 ** Not unique table/alias: 'civicrm_group_contact_cache_8'

I cleared all Drupal caches, and did a "Cleanup caches" at /civicrm/admin/setting/updateConfigBackend?reset=1

Any ideas on what is going on ?

[flo81]

I answser myself here, I don't fully understand what happens, but I created a new smart group, define new ACLs on this group (view and edit), and all works fine. So in fact the problem happens only when trying to define ACLs on smart groups I created when I was running CiviCRM 4.5.4 (before upgrade). I guess I have to redefine all my smart groups.